Where it started.
The institution was growing fast, launching mobile banking and facing rising expectations from its regulator. Not all workstations were up to date, admin accounts were shared and nobody was watching the logs.
The challenge
Quickly reduce the most serious risks without disrupting branches, then build a detection and response capability the internal team can sustain.
- 45 branches with mixed connections and equipment.
- A small internal IT team.
- Regulatory requirements to document.
- No offensive testing without signed authorization and rules of engagement.
What we built.
A three-part program: govern (maturity assessment and roadmap), test (authorized penetration test of mobile banking and the branch network), defend (EDR on every endpoint, centralized logging, detection use cases and response procedures).
- Maturity assessment and a roadmap approved by leadership.
- Authorized penetration test, then a retest after fixes.
- Named privileged accounts and strong authentication.
- EDR and centralized logging, with 25 detection use cases.
- Incident response plan and a crisis exercise with leadership.
How the project ran.
- 01
Govern. Assessment, risk mapping and priorities approved by the executive committee.
- 02
Test. A scoped penetration test, findings and a remediation plan.
- 03
Defend. EDR rollout, centralized logs and triage procedures.
- 04
Rehearse. A crisis exercise and handover to the internal team.
What changed.
Indicators tracked after launch.
100%
of critical vulnerabilities fixed and retested
-80%
privileged accounts, all named and protected
< 30 min
to triage a critical alert, where nothing was monitored before
What made the difference
Starting with leadership. A roadmap approved by the executive committee gave IT the mandate and budget to act.
Technologies
Microsoft Defender · Microsoft Sentinel · Entra ID · PAM · ISO 27001
